Managing non iOS student Machines

New Contributor III

Just hoping to maybe find some help with managed preferences.
Working in a High School with profiles for Staff/Students and student groups, Im curious to see what others feel is successful.
I am working on the image for the upcoming school year. Hoping to find help limiting the access to ALL FOLDERS other than the user's folders (applications,desktop,documents,downloads,music,movies,pictures,public,google drive)

Is there anyone that may know how to restrict renaming applications? lots of students renaming games.
What are some other things other people have done?
Anything you think works well would be greatly appreciated!